When you send a prompt to an AI model through someone else’s service, you take the model’s name on trust. Anthropic’s research post of November 2, 2026, puts it plainly: “A user querying a model today cannot check that the responses came from the specific model that a developer claims is responding, as opposed to one secretly substituted in by a routing service for cost reasons, or even by an attacker who has tampered with the token stream.” FlashProve is its answer: an open prototype that attaches a cryptographic proof to each reply.
The release has five parts: the post, a technical report, a protocol description, a prover with two verifiers (a fast one in C++ and a slow, formally checked one in Lean), and Lean proofs of the security claims. Code, proofs and docs are Apache 2.0. Anthropic frames it as a work in progress: “This research post is meant to share intermediate progress, and not a completed research agenda.”
On this page · 8 sectionsOpen
Anthropic published FlashProve on November 2, 2026: an open research prototype that lets an AI provider prove which model produced a reply, without revealing the model’s weights.
On Llama 4 Maverick (400B parameters, a mixture of experts), one H100 proves about 110 tokens per second, and each 1,024-token request gets an 18.78 MB proof.
Anyone can check a proof on an ordinary CPU in about 17 seconds on 24 threads, with no GPU and no access to the weights.
Proving costs about 72 times the GPU time of serving the same requests on vLLM (66 to 77 across runs, about 94 at the highest load), down from hours per token in earlier systems.
The protocol’s soundness, completeness and zero-knowledge are proved in Lean, and the code, proofs and docs are released under Apache 2.0.
It is a prototype: 1,024-token contexts, greedy decoding on an integer version of the model, MoE models only, and no formal guarantee that the fast code matches the Lean protocol.
§ 01How it works: commit, prove, verify
In the offline phase the provider publishes a commitment, a short fingerprint that pins down one exact set of weights. In the online phase it proves, for each request, that the committed model produces exactly these output tokens for this prompt. The proof is a zkSNARK: zero-knowledge, so it reveals nothing about the weights, and succinct, so it is fast to check. A provider that serves a different model cannot produce a valid proof for the committed one.
Anthropic also says the system was largely built by its model: “Claude has produced improvements on zkSNARKs for inference, building a system that is substantially faster than prior open-source systems.” It adds the caveat that motivated the Lean proofs: “Claude is good at optimization, but often makes decisions that are hard to evaluate, especially in large complex systems.”
§ 02FlashProve by the numbers
| Measure | Reported value |
|---|---|
| Model proved | Llama 4 Maverick, 400B-parameter mixture of experts (~17B used per token), public 4-bit weights |
| Prover hardware | 1 H100 GPU, 24 CPU cores, ~290 GB of host memory |
| Proving speed | ~110 tokens per second (a batch of 24 requests in ~223 seconds) |
| Proof size | 18.78 MB per 1,024-token request |
| Verification | 17 seconds on 24 CPU threads, 21 seconds on one thread, no GPU |
| Commitment | ~6.5 MB download; ~39 minutes to create; good for ~16 million requests |
| Overhead vs serving | ~72x the GPU time of vLLM (66x to 77x across runs), ~94x at vLLM’s highest load tested |
| Context length | Up to 1,024 tokens |
| License | Apache 2.0 (code, Lean proofs, docs) |
The overhead is the headline. Two orders of magnitude is still expensive, so the design proves requests in batches after the fact (post-hoc), not alongside every live reply. But it is the first time an open system has proven a model this size at a speed measured in tokens per second rather than hours per token.
§ 03The speed jump, against earlier systems
| System | Model | Tokens per second |
|---|---|---|
| ZKML | GPT-2 (117M) | 0.006 |
| zkPyTorch | Llama-3 8B, one CPU core | 0.007 |
| VerInf | Llama 4 Maverick (same model) | 0.02 |
| zkLLM (2024) | LLaMA-2-13B, in a batch | ~2.5 |
| DeepProve | GPT-2 / distributed | 2.9 / 31 |
| Attestable (no open-source library) | Gemma 4 31B, one H100 | 53 to 77 |
| FlashProve | Llama 4 Maverick, one H100 | ~110 |
The like-for-like comparison is VerInf, the only earlier proof of Llama 4 Maverick Anthropic knows of: 14.3 hours for 1,000 tokens and a 93.6 GB proof that took almost a day to verify. FlashProve does the same model at ~110 tokens per second with 19 MB proofs checked in seconds. Attestable, a commercial effort, reports 53 to 77 tokens per second on a smaller dense model and has not released code.
§ 04What Anthropic says it is for
| Use | The question it answers |
|---|---|
| Pacing | Is this provider’s hardware really serving the claimed model, not quietly freed up for training? |
| Tamper detection | Is a compromised server, or a model posing as a weaker one, answering in place of the authorized weights? |
| Text provenance | Did a frontier model really scan this code or review this plan, as claimed? |
| Model approval | Is the provider serving only models a regulator approved? |
One note on the bigger picture: Anthropic had set a public goal of a provable-inference prototype by September 30, 2026. It says it met that goal through a separate project that signs its inference traffic and recomputes inference on a trusted server, and that on October 19 it renamed the goal “inference verification”. FlashProve is the cryptographic route to the same aim, released in the open.
§ 05What it does not do yet
| Limit | What it means |
|---|---|
| 1,024-token contexts | Far short of the hundreds of thousands of tokens frontier chats use |
| Integer model, greedy decoding | A floating-point reply or sampled decoding can drift from what was proved |
| Mixture-of-experts only | Dense models are not covered; the architecture itself is not hidden |
| Fast code not formally checked | The Lean protocol is proved; the fast C++ and GPU code is only tested against it |
| Side channels out of scope | Timing of proof generation could leak information about the weights |
The repository calls itself “a research artifact: not maintained, not accepting contributions.” It is a proof that the approach is practical, not a product a provider can switch on.
§ 06What it means if you buy AI through someone else
Most businesses reach models through a layer in between: a router, a reseller, an app, or a platform like ours. CellCog names the model its agents run on (Claude Opus 5.5), and today our users, like everyone else’s, take that on trust. FlashProve does not change that for Claude yet: it proves an open model, at short contexts, at a large GPU cost. What it shows is that the question of which model answered is becoming a checkable fact rather than a promise, and that the cost of checking is falling fast. Expect buyers and evaluators to start asking for it.
§ 07Update log
- November 3, 2026: explainer animation added.
- November 3, 2026: page opened, from Anthropic’s November 2 post and the FlashProve repository read November 3.
§ 08Sources
- Anthropic, Progress on provable inference for large language models, November 2, 2026.
- Anthropic, FlashProve technical report.
- FlashProve on GitHub, version 0.16.0, Apache 2.0.
Q1What problem does provable inference solve?
Today a user cannot check that a reply came from the model they asked for rather than a cheaper one swapped in by a router, or a stream tampered with by an attacker. A proof attached to the reply makes that checkable.
Q2Does the proof reveal the model's weights?
No. The proof is zero-knowledge for the weights. The model’s architecture is not hidden in this release, and Anthropic lists side channels such as proving time as out of scope.
Q3Can I run it myself?
Verifying a stored proof needs Linux, g++ 13 and under 2 GB of RAM. Proving the full model needs an H100 and about 290 GB of host memory, plus the public 4-bit weights from Hugging Face.
Q4Is this the same as Anthropic's September 30 inference-verification goal?
No. Anthropic says it met that goal with a separate project that signs its inference traffic and recomputes inference on a trusted server. FlashProve pursues the same aim by cryptography.
Q5Why does this matter to people using AI through other services?
Anyone buying model access through a reseller or router takes the model name on trust today. Proofs like these could let a buyer, an evaluator or a regulator check it.